Method and device for analyzing defects of black-box adversarial attacks on power artificial intelligence applications

Abstract

The present application belongs to the technical field of artificial intelligence security, and particularly relates to a power artificial intelligence application black box adversarial attack defect analysis method and device. The method comprises: constructing a double-layer threshold mechanism combining local and global; based on the approximate gradient of the target model for the original input sample in the current round, calculating the perturbation in the current round, using the local perturbation threshold to constrain the perturbation in the current round, and updating the adversarial sample based on the constrained perturbation; using the global perturbation threshold to reasonably determine the perturbation amplitude of the updated adversarial sample, and determining the attack effect of the adversarial sample meeting the reasonable determination condition, and taking the adversarial sample meeting the attack effect determination condition as the target adversarial sample and outputting. The present application discloses the tolerance range of the power system under the double-layer threshold perturbation, thereby providing a reference for the design of the defense mechanism.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence security, and particularly relates to a method and device for analyzing defects of black-box attack on power artificial intelligence. BACKGROUND

[0002] With the deep application of deep neural networks in key infrastructures such as power dispatch, the security risks caused by the decision vulnerability of deep neural networks have become a key bottleneck restricting the landing of technology. Since artificial intelligence applications such as deep neural networks usually take real-time measurement data as input, attackers can construct adversarial perturbations that cannot be detected by existing security protection mechanisms, causing artificial intelligence applications to make catastrophic misjudgments, and seriously threatening the safe operation of security-critical infrastructures such as power.

[0003] In actual scenarios, attackers are difficult to obtain the structure and gradient information of the model, and can only design adversarial perturbations by querying the output results of the model. For this reason, researchers have proposed a series of black-box attack algorithms. Among them, the method based on zeroth-order optimization (ZOO) estimates the gradient information through finite difference, which can approximate the gradient direction without relying on the model gradient, and realize the iterative generation of adversarial samples. Although it can achieve a relatively high attack success rate to a certain extent, it has problems such as a sharp increase in the number of queries with the complexity of the task, which easily leads to low attack efficiency, and the generated adversarial samples do not conform to the constraints of actual scenarios. Therefore, there is an urgent need for a new black-box attack method to improve the query efficiency of black-box adversarial attacks.

[0004] Chinese patent document CN117240624A discloses an adversarial attack sample generation and testing method and device based on a black-box scenario. The method includes: obtaining a traffic sample set and inputting it into a target classifier, collecting the classification results of the target classifier, and combining the classification results and the traffic sample set into a complete data set; inputting the complete data set into a to-be-debugged classifier to train the to-be-debugged classifier into a replacement classification model; generating an adversarial sample according to the complete data set; inputting the adversarial sample into the replacement classification model for testing; this method generates an adversarial sample with realistic constraints for attack traffic, improves the practicality of the adversarial sample, and makes the scenario simpler, the attack more effective, and the adversarial attack more suitable for the real world.

[0005] The Chinese patent document CN113822443A discloses a method for generating an adversarial sample and resisting an attack. The method for generating an adversarial sample comprises: based on an initial sample, a label of the initial sample, and a model to be attacked, performing one or more iterations to construct an adversarial sample; one iteration comprises: obtaining an adjusted sample of a current round; when the current round is the first iteration, the adjusted sample is the initial sample, otherwise, the adjusted sample is an adversarial sample of a previous round; processing the adjusted sample by using the model to be attacked to obtain a first output; based on a difference between the first output and the label, and a perturbation coefficient, determining perturbation data; adding the perturbation data to the adjusted sample to obtain an adversarial sample of the current round; wherein the perturbation coefficient can be adjusted to make the difference between the adversarial sample and the initial sample approach but not exceed a preset perturbation boundary value.

[0006] Therefore, the present application designs a power artificial intelligence application black box adversarial attack defect analysis method to improve the query efficiency and the concealment of the adversarial sample in the design of the black box adversarial attack. SUMMARY

[0007] The present application aims to overcome at least one of the above-mentioned defects of the prior art, and provides a power artificial intelligence application black box adversarial attack defect analysis method. Through the double-layer mechanism of combining the local perturbation threshold with the global perturbation threshold, the attack success rate, the query efficiency, and the detection avoidance ability of the adversarial sample are effectively improved without relying on the model structure information.

[0008] The present application also discloses a device loaded with the power artificial intelligence application black box adversarial attack defect analysis method.

[0009] The detailed technical solutions of the present application are as follows:

[0010] A power artificial intelligence application black box adversarial attack defect analysis method is applied to an intelligent power grid system comprising a plurality of nodes, and the method comprises:

[0011] S1, based on time residual analysis, constructing a local perturbation threshold for each feature dimension of an original input sample, wherein the original input sample is node measurement data comprising a plurality of feature dimensions;

[0012] S2, using an LSTM model to predict based on the historical state of the original input sample, obtaining a predicted value of the original input sample at a current state, and constructing a global perturbation threshold based on the residual between the predicted value of the original input sample at the current state and the actual value thereof;

[0013] S3. Based on the approximate gradient of the target model for the original input sample in the current round, calculate the perturbation in the current round, constrain the perturbation in the current round using the local perturbation threshold, and update the adversarial sample based on the constrained perturbation.

[0014] S4. Use the global perturbation threshold to determine the reasonableness of the perturbation amplitude of the updated adversarial sample, and determine the attack effect of the adversarial sample that meets the reasonableness determination condition. Then, take the adversarial sample that meets the attack effect determination condition as the target adversarial sample and output it.

[0015] According to a preferred embodiment of the present invention, in step S1, constructing a local perturbation threshold for each feature dimension of the original input sample specifically includes:

[0016] A sliding window mechanism is used to extract the historical observation sequence of each feature dimension of the original input sample in order to obtain the predicted value of each feature dimension of the original input sample.

[0017] Based on the residual between the true value and the predicted value of each feature dimension of the original input sample, a moving average method is used to obtain the nearest value of each feature dimension of the original input sample. The average residual at each time point;

[0018] Based on each feature dimension of the original input sample, the most recent The average residual at each time step is used to construct the local perturbation threshold corresponding to this feature dimension:

[0019]

[0020] In formula (5): Represents the original input sample The Local perturbation thresholds in each dimension; Indicates the perturbation scaling factor; Represents the original input sample The Each dimension in recent The average residual at each time point.

[0021] According to a preferred embodiment of the present invention, in step S2, constructing a global perturbation threshold based on the residual between the predicted value and the actual value of the original input sample in the current state specifically includes:

[0022] Calculate the residual between the predicted value and the actual value of the original input sample in the current state:

[0023]

[0024] In formula (7): denotes the original input sample at the current moment state and its actual value ; denotes the L2 norm

[0025] The global perturbation threshold is constructed as follows:

[0026] ,

[0027] In formula (8): denotes the interval range of the global perturbation threshold.

[0028] According to the application, preferably, in the S3, the perturbation at the current round is calculated based on the approximate gradient of the target model for the original input sample at the current round, and specifically includes:

[0029] The approximate gradient of the target model for the original input sample at the current round is obtained by using the finite difference method:

[0030]

[0031] In formula (9): denotes the output function of the target model, i.e. the objective function denotes the approximate gradient of the target model for the original input sample at the first dimension; is a standard basis vector, and only the first dimension is 1, and the remaining dimensions are 0; is a constant;

[0032] The approximate gradient of the original input sample at all dimensions is integrated into a vector , and its signed direction is taken and multiplied by the perturbation step, i.e. the perturbation at the current round is obtained:

[0033]

[0034] In formula (10): denotes the perturbation at the current Mth round denotes the perturbation step denotes the sign function, which is used to convert positive numbers to 1 and negative numbers to -1.

[0035] According to the application, preferably, in the S3, the perturbation at the current round is constrained by using the local perturbation threshold:

[0036]

[0037] In formula (11), represents the perturbation in the Mth round of the current original input sample

[0038] According to the application, preferably, in S3, the adversarial sample is updated based on the perturbation after the constraint:

[0039]

[0040] In formula (12), represents the adversarial sample in the Mth round;

[0041] According to the application, preferably, in S4, the rationality judgment condition is:

[0042]

[0043] In formula (13), represents the updated adversarial sample;

[0044] The attack effect judgment condition is:

[0045]

[0046] In formula (14), represents the prediction of the target model on the updated adversarial sample

[0047] In another aspect of the application, a device for implementing a power artificial intelligence application black box adversarial attack defect analysis method is provided, and the device comprises:

[0048] A local threshold construction module is configured to construct a local perturbation threshold for each feature dimension of an original input sample based on time residual analysis, wherein the original input sample is node measurement data containing multiple feature dimensions.

[0049] ​​​​​​​​​​​​​​​​​​​a global threshold construction module configured to utilize an LSTM model to make a prediction based on a historical state of the original input sample, obtain a predicted value of the original input sample at a current state, and construct a global perturbation threshold based on a residual error between the predicted value of the original input sample at the current state and an actual value thereof;

[0050] a sample updating module configured to calculate a perturbation at a current round based on an approximate gradient of the target model for the original input sample at the current round, constrain the perturbation at the current round by utilizing the local perturbation threshold, and update the adversarial sample based on the constrained perturbation;

[0051] a result determination module configured to utilize the global perturbation threshold to make a rationality determination on a perturbation amplitude of the updated adversarial sample, make an attack effect determination on the adversarial sample that meets the rationality determination condition, and output the adversarial sample that meets the attack effect determination condition as a target adversarial sample.

[0052] In another aspect of the present application, an electronic device is also provided, comprising:

[0053] at least one processor; and

[0054] a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the power artificial intelligence application black-box adversarial attack defect analysis method as described above.

[0055] In another aspect of the present application, a machine-readable storage medium storing executable instructions is also provided, the instructions, when executed, causing the machine to perform the power artificial intelligence application black-box adversarial attack defect analysis method as described above.

[0056] Compared with the prior art, the present application has the following beneficial effects:

[0057] (1) The power artificial intelligence application black-box adversarial attack defect analysis method provided by the present application effectively improves the attack success rate, query efficiency and detection avoidance ability of the adversarial sample by the double-layer mechanism combining the local perturbation threshold with the global perturbation threshold without relying on the model structure information.

[0058] (2) Compared with the method in the prior art that only relies on the norm constraint or the fixed perturbation step, the double-layer threshold control mechanism proposed by the present application can make the perturbation closer to the normal fluctuation range of the system, has high concealment, avoids the problem that the threshold is too large and is discovered by the power system detector, and avoids the problem that the threshold is too small and leads to low query efficiency.

[0059] (3) Unlike the prior art which only focuses on attack success rate, the present application can analyze the samples after the successful attack samples are generated, which can reveal the tolerance range of the power system under double-layer threshold disturbance. The analysis results can provide a reference for the design of defense mechanisms, such as enhancing the robustness of specific feature dimensions, adjusting the abnormal detection sensitivity of the time series prediction module, thereby improving the overall anti-attack ability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0060] Figure 1 is a flowchart of the power artificial intelligence application black box adversarial attack defect analysis method of the present application.

[0061] Figure 2 is an architecture diagram of the power system application black box adversarial attack in embodiment 1 of the present application.

[0062] Figure 3 is a visualization result heat map of the attack sample disturbance mean in embodiment 1 of the present application.

[0063] Figure 4 is a comparison diagram of the present application method and the prior art attack method. DETAILED DESCRIPTION

[0064] The present application will be further described below in conjunction with the drawings and embodiments.

[0065] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise indicated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0066] It should be noted that the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and furthermore, it should be understood that when the terms "comprise" and / or "include" are used in the specification, there is a feature, step, operation, device, component and / or combination thereof.

[0067] The embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0068] The present application designs a black box adversarial attack design method based on double-layer threshold, which is mainly used to solve the problem that in the black box scenario where the structure and parameter information of the target model cannot be obtained, the number of queries is too large in the adversarial sample construction process, it is difficult to avoid various power system security protection mechanisms, and it cannot guarantee the secrecy of the adversarial attack.

[0069] The existing adversarial attack method is mostly derived from the image recognition field, and the secrecy standard thereof is usually based on the invisibility of input disturbance to human eyes, such as a small L2 norm, pixel change smoothness and the like. The secrecy standard of the power grid system is proposed in the application, which is not the perception vision, but the behavior deviation degree of the system after the disturbance. Therefore, the disturbance secrecy redefinition method for the power grid scene is proposed, and the local disturbance threshold and global disturbance threshold constraint mechanism based on the time prediction residual are constructed, and a new disturbance generation strategy suitable for the power system environment is established.

[0070] The double-layer concealment protection mechanism combining the local disturbance threshold and the global disturbance threshold is used in the application, so that the attack success rate, the query efficiency and the detection avoidance ability of the adversarial sample are effectively improved without relying on the model structure information.

[0071] The power artificial intelligence application black box adversarial attack defect analysis method and device of the application will be further described below in combination with specific embodiments.

[0072] Embodiment 1,

[0073] Reference Figure 1 The embodiment provides a power artificial intelligence application black box adversarial attack defect analysis method, which is applied to an intelligent power grid system comprising a plurality of nodes, and aims to improve the query efficiency and the concealment of the adversarial sample in the design of the black box adversarial attack in the power grid field.

[0074] In the adversarial attack method, the secrecy of the disturbance is an important standard for measuring the attack quality. The secrecy means that the attack sample should successfully induce the target model to output an incorrect result under the premise that the disturbance amplitude is as small as possible, and at the same time, avoid being identified as a suspicious input by the abnormal detection mechanism in the system. Although there are requirements for secrecy in many application fields, the definition standards of the secrecy in different scenes are essentially different.

[0075] The existing adversarial attack method is mostly derived from the image recognition field. In the image classification task, the input is usually a pixel matrix (two-dimensional array), and the secrecy of the disturbance is mainly related to the perceptibility of human eyes. Research generally believes that as long as the disturbance does not significantly change the appearance or perceptual effect of the image, it is considered to be secret.

[0076] Therefore, a large number of adversarial attack methods in the image field, such as the gradient-based adversarial attack method (Fast Gradient Sign Method, FGSM), the projected gradient descent method (Projected Gradient Descent, PGD), the optimization-based C&W attack method and the like, all control the disturbance intensity in the following form:

[0077]

[0078] In formula (1): is the original input image, is the attack sample after adding perturbations, is the set upper limit of the perturbation, which is usually small, is the norm type. This norm control strategy uses the human visual system as the criterion for invisibility, is suitable for the image data scenario, and is widely accepted as a standard method.

[0079] In the smart grid, the input samples usually consist of physical quantities of multiple nodes, such as bus voltage amplitude, phase angle, active power, reactive power, etc. This type of data has significant physical constraints, network topology correlation, and time-series evolution characteristics. The model often includes behavior prediction and anomaly detection modules. Therefore, the "invisibility" of perturbations in the power grid field no longer depends solely on the size of the perturbation, but on whether the perturbation destroys the spatial correlation and the consistency of time-series prediction. Therefore, in the power grid, the "invisibility" of perturbations should be measured from the perspective of the physical tolerance of the system, rather than just the "geometric minuteness" at the norm level.

[0080] Based on this, the method of this embodiment introduces a more structurally adaptable perturbation constraint mechanism in the physical system. It not only sets local perturbation thresholds but also constructs global perturbation thresholds for the overall perturbation amplitude of the input, that is, the acceptable upper and lower bounds of the L2 norm of the adversarial perturbation, thereby enhancing the system invisibility of the adversarial perturbation.

[0081] Refer to Figure 1 and Figure 2 , the method includes:

[0082] S1. Based on time-residual analysis, construct local perturbation thresholds for each feature dimension of the original input sample, where the original input sample is node measurement data containing multiple feature dimensions.

[0083] Specifically, denote the original input sample as , where represents the 4 feature dimensions of the original input sample , for example, they can be the voltage amplitude, phase angle, active power, and reactive power of nodes in the power grid system; its corresponding true label is representing the normal or abnormal operating state determined by the neural network classifier for the sample.

[0084] First, use the sliding window mechanism to extract the historical observation sequences of each feature dimension of the original input sample to estimate the normal state trend of this feature dimension. For example, for the th dimension of the original input sample , construct the predicted value within the time window length :

[0085]

[0086] In equation (2), represents the historical observation sequence of the th dimension of the original input sample at the current time step represents the time prediction model constructed based on the window sequence represents the prediction value of the th dimension of the original input sample at the current time step

[0087] Then, the difference between the real value and the prediction value of the th dimension of the original input sample at the current time step is defined as the residual In equation (3), represents the residual between the real value and the prediction value of the th dimension of the original input sample at the current time step

[0088]

[0089] In equation (4), represents the average residual of the th dimension of the original input sample at the last time steps

[0090]

[0091]

[0092] In equation (4), represents the average residual of the th dimension of the original input sample at the last time steps

[0093] ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​It should be understood that the residual average value characterizes the fluctuation range of each dimension of the input in the normal state, and the smaller the value, the more stable the recent state of the corresponding node, and the lower the disturbance tolerance.

[0094] Finally, the local disturbance threshold is defined, that is, the local disturbance threshold is constructed for each feature dimension of the original input sample According to the residual average value of the original input sample The local disturbance threshold for the first dimension of the original input sample

[0095]

[0096] In formula (5): The local disturbance threshold of the first dimension of the original input sample ; The disturbance scaling factor, which is a proportional compression of the maximum disturbance tolerance, prevents excessive disturbance.

[0097] It should be understood that the local disturbance threshold reflects the local tolerance of the node to the disturbance, and serves as the local disturbance range of each dimension of the input during the attack process.

[0098] Therefore, in order to ensure the concealment of the disturbance in each input feature dimension, the embodiment calculates the historical residual fluctuation range of each dimension of the input sample by the time series modeling method, and constructs the local disturbance threshold according to the historical residual fluctuation range.

[0099] S2, using the LSTM model to predict based on the historical state of the original input sample, obtaining the predicted value of the original input sample at the current state, and constructing the global disturbance threshold based on the residual between the predicted value of the original input sample at the current state and its actual value.

[0100] In order to enhance the concealment of the system against disturbance, the embodiment not only sets the local disturbance threshold for each input dimension, but also constructs the global disturbance threshold of the overall disturbance amplitude of the input. The state input in the smart grid has obvious time trend, and the system usually deploys time series model such as LSTM model for dynamic prediction and anomaly detection.

[0101] In this embodiment, the LSTM model is used to model the input residual to determine the globally tolerable range of the disturbance. Specifically, the LSTM model is used to predict the historical state of the original input sample

[0102]

[0103] In formula (6): The global disturbance threshold of the original input sample ​the historical state sequence of the system denotes the original input sample output by the LSTM model the prediction value of the current time state, i.e., the original input sample the prediction value of the current state.

[0104] Subsequently, the residual error between the prediction value of the original input sample at the current state and the actual value thereof is calculated:

[0105]

[0106] In formula (7): denotes the original input sample at the current time state and the actual value thereof, and the residual error sequence in a period of time is taken to depict the normal input deviation range of the system.

[0107] Finally, the global disturbance threshold is defined. The upper and lower limits of the system prediction error are taken as the legal threshold of the attack disturbance:

[0108] ,

[0109] In formula (8): i.e., the range of the global disturbance threshold, denotes the lower limit and the upper limit of the system prediction error.

[0110] It should be understood that the global disturbance threshold is used to ensure that the disturbance amplitude is overall within the system error tolerance interval and is not identified as abnormal by the prediction model.

[0111] S3, based on the approximate gradient of the target model for the original input sample at the current round, calculate the disturbance at the current round, constrain the disturbance at the current round by using the local disturbance threshold, and update the adversarial sample based on the constrained disturbance.

[0112] In adversarial attacks, subtle disturbances are added to input data to make the model output incorrect results, so as to detect the robustness of the model. In the present embodiment, let the initial adversarial sample , the initial disturbance is 0, and set the maximum iteration round , wherein denotes the current round, and the adversarial sample is updated by using the approximate gradient obtained in each round and then subjected to local threshold constraint.

[0113] ​​​Specifically, the ZOO attack (black-box adversarial attack) phase mainly utilizes the finite difference technique to estimate the gradient of the target model, that is, the approximate gradient of the target model for the original input sample in the current round is obtained by using the finite difference method. In this embodiment, the target model can be a classification model.

[0114] Since the specific parameters of the target model are unknown under black-box attack, the finite difference method can be used to obtain the approximate gradient of the original input sample in the current round:

[0115]

[0116] In formula (9): denotes the output function of the target model, that is, the target function; denotes the approximate gradient of the target model for the original input sample in the first dimension; is a standard basis vector, and only the first dimension is 1, and the remaining dimensions are 0; is a small constant, representing the small perturbation amount of the finite difference.

[0117] This formula is the standard form of the "forward difference" in numerical analysis, which is used to estimate the derivative of the target function at the original input sample in the first dimension.

[0118] Next, based on the approximate gradient of the original input sample in the current round, the perturbation in the current round is calculated. Specifically, the approximate gradient of all dimensions of the original input sample is integrated into a vector , and then the sign direction (to avoid the influence of the absolute size) is taken and multiplied by the perturbation step, that is, the perturbation in the current round is obtained:

[0119]

[0120] In formula (10): denotes the perturbation in the current Mth round; denotes the perturbation step; denotes the sign function, which converts positive numbers to 1 and negative numbers to -1. This method can control the consistency of the perturbation direction and avoid excessive response to noise gradients.

[0121] Subsequently, the perturbation in the current round is constrained by using the local perturbation threshold obtained in the foregoing. Specifically, to prevent the perturbation amplitude in each input feature dimension from exceeding the range of the local perturbation threshold, the clipping operation is used to constrain the perturbation in this embodiment. For the perturbation of the original input sample in the first dimension in the current Mth round, the constraint is:

[0122]

[0123] In formula (11), represents the original input sample under the current Mth round represents the disturbance

[0124] Finally, the constrained disturbance is used to update the adversarial sample, that is, based on the current adversarial sample, the constrained disturbance is applied in the gradient direction to obtain the updated adversarial sample:

[0125]

[0126] In formula (12), represents the adversarial sample under the current Mth round

[0127] S4, the rationality of the disturbance amplitude of the updated adversarial sample is determined by using the global disturbance threshold, and the attack effect of the adversarial sample meeting the rationality determination condition is determined, and the adversarial sample meeting the attack effect determination condition is taken as a target adversarial sample and output.

[0128] The updated adversarial sample may exceed the prediction residual tolerance range of the LSTM model, that is, the range of the global disturbance threshold Therefore, further norm range adjustment is required. Determine whether the total disturbance norm meets:

[0129]

[0130] In formula (13), represents the updated adversarial sample

[0131] This formula (13) is the rationality determination condition of the disturbance amplitude of the updated adversarial sample. If the formula (13) is met, it means that the current disturbance is in a reasonable range, and the attack effect of the adversarial sample is determined in the next step; if the formula (13) is not met, the attack attempt is directly terminated and recorded as an attack failure.

[0132] Based on the above, after completing each round of disturbance update and applying local and global disturbance constraints, the attack effect of the adversarial sample meeting the rationality determination condition is determined: ​​​​​​​​​​

[0133]

[0134] In formula (14), represents the target model to the updated adversarial sample , represents the model parameter , is the true label of the original input sample , and is the target class in the classification task.

[0135] This formula (14) is the attack effect determination condition of the adversarial sample.

[0136] In the first round, after completing the disturbance update and applying the local and global disturbance constraints, the updated adversarial sample is obtained, the state is updated, and the above-mentioned adversarial sample is taken as the initial state of the next round, and then the attack effect determination is performed. If the prediction result satisfies formula (14), it indicates that the model prediction is wrong, the attack is successful, and the latest adversarial sample is returned; otherwise, it is determined that the attack fails, the round count is incremented, and the updated state enters the next round, and the above-mentioned process is continued until the success condition is satisfied or the maximum iteration round is reached.

[0137] The effectiveness of the method of the present application is verified by the following related comparative experiments.

[0138] Experiments are carried out in the IEEE 14-node power system data environment, and the existing methods are compared in terms of performance. In the experiment, the attack success rate index is mainly investigated to evaluate the stability of the algorithm. Among them, the existing methods include zero-order optimization attack method, symbolic optimization attack method, bit scheduling attack comparison method, hybrid attack method, etc.

[0139] 1) Data and model:

[0140] The IEEE 14-node system is a standard power system stability evaluation platform, which includes 5 synchronous generators, 11 transmission lines, and multiple busbars, charge nodes, etc., and is commonly used for power system situation prediction and disturbance detection tasks.

[0141] In this experiment: four characteristics of node voltage amplitude, phase angle, active power and reactive power are collected to form the original input sample. The data set composed of the original input sample is divided into training set and test set according to the ratio of 8:2, and all inputs are normalized real numbers.

[0142] Target model, i.e. classification model, wherein the intermediate layer is composed of three fully connected layers and ReLU activation function; the output layer of the model is composed of Softmax activation function for binary classification output.

[0143] 2) Experimental conditions:

[0144] The method of the present application is compared with several typical black box attack methods in performance. A set of experiments under different perturbation limit conditions are specifically designed to evaluate the success rate of different algorithms under the limited number of queries.

[0145] 3) Implementation details:

[0146] The optimizer used in model training is Adam, the learning rate is set to 0.001, and the loss function is cross-entropy loss. The batch size is set to 32, the total training round is 60, 90% of the samples are used for training each round, and 10% is used as the validation set. The model is evaluated on the complete test set. The initial value of the perturbation step is 0.01.

[0147] 4) Experimental results:

[0148] As Figure 3 shown, in the process of implementing the constraint type black box attack on 200 normal samples, the perturbation matrix of all successful attack samples is counted and averaged to obtain the spatial distribution of the perturbation in different time steps and feature dimensions. The horizontal axis is four typical power system operating state features, including voltage, electric angle, active power and reactive power, and the vertical axis is five time steps for each sample. The color depth represents the size and direction of the perturbation, where red represents positive perturbation and blue represents negative perturbation, and the deeper the color, the larger the perturbation amplitude.

[0149] It can be observed from Figure 3 that the perturbation is mainly concentrated in the "reactive power" and "voltage" dimensions, especially at time steps 1 and 5, there are obvious positive and negative perturbations respectively. This indicates that the method has significant target selectivity in perturbation spatial distribution, effectively improving the attack efficiency.

[0150] As Figure 4 shown, when the maximum number of queries is set to 10,000, the method always maintains a leading attack success rate. This result verifies that the method can quickly converge in a given perturbation space and obtain more effective perturbation directions. This advantage makes the method particularly suitable for security evaluation and attack-defense simulation scenarios in resource-constrained environments.

[0151] Example 2,

[0152] The embodiment provides a device for realizing a power artificial intelligence application black box attack defect analysis method, and the device comprises:

[0153] A local threshold construction module is used to construct a local perturbation threshold for each feature dimension of the original input sample based on time residual analysis, wherein the original input sample is node measurement data containing multiple feature dimensions;

[0154] The global threshold construction module is used to make predictions based on the historical states of the original input sample using the LSTM model, obtain the predicted value of the original input sample in the current state, and construct a global perturbation threshold based on the residual between the predicted value of the original input sample in the current state and its actual value.

[0155] The sample update module is used to calculate the perturbation in the current round based on the approximate gradient of the target model for the original input sample in the current round, constrain the perturbation in the current round using the local perturbation threshold, and update the adversarial sample based on the constrained perturbation.

[0156] The result determination module is used to determine the reasonableness of the perturbation amplitude of the updated adversarial sample using the global perturbation threshold, and to determine the attack effect of the adversarial sample that meets the reasonableness determination condition. The adversarial sample that meets the attack effect determination condition is then used as the target adversarial sample and output.

[0157] Example 3

[0158] This embodiment also provides an electronic device, including:

[0159] At least one processor; and

[0160] A memory that stores instructions, which, when executed by the at least one processor, cause the at least one processor to perform the black-box adversarial attack defect analysis method for power artificial intelligence applications as described above.

[0161] In this embodiment, the electronic device may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile computing device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable computing device, consumer electronic device, etc.

[0162] Example 4

[0163] This embodiment also provides a machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the black-box adversarial attack defect analysis method for power artificial intelligence applications as described above.

[0164] In particular, a system or apparatus can be provided with a readable storage medium on which software program codes for implementing the functions of any of the above embodiments are stored, and a computer or processor of the system or apparatus is caused to read and execute the instructions stored in the readable storage medium.

[0165] In this case, the program codes read from the readable medium can themselves implement the functions of any of the above embodiments, and thus the machine readable codes and the readable storage medium storing the machine readable codes constitute a part of the present specification.

[0166] Embodiments of the readable storage medium include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROMs, CD-Rs, CD-RWs, DVD-ROMs, DVD-RAMs, DVD-RWs, DVD-RWs), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program codes can be downloaded from a server computer or a cloud over a communication network.

[0167] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer usable program codes.

[0168] Obviously, the above-described embodiments of the present application are merely examples for clearly illustrating the technical solutions of the present application, and are not intended to limit the specific embodiments of the present application. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for analyzing defects of power artificial intelligence application black box attack, characterized in that, The method is applied to a smart grid system comprising a plurality of nodes, and comprises: S1, constructing a local perturbation threshold for each feature dimension of an original input sample based on time residual analysis, wherein the original input sample is node measurement data comprising a plurality of feature dimensions; wherein the local perturbation threshold is constructed, specifically comprising: extracting a historical observation sequence of each feature dimension of the original input sample by using a sliding window mechanism to obtain a predicted value of each feature dimension of the original input sample; Based on the residual error between the true value and the predicted value of each feature dimension of the original input sample, the residual error average value of each feature dimension of the original input sample at the latest time is obtained in a sliding average manner. Based on the residual error between the true value and the predicted value of each feature dimension of the original input sample, the residual error average value of each feature dimension of the original input sample at the latest time is obtained in a sliding average manner. based on the residual mean value of each feature dimension of the original input sample at the nearest time, a local disturbance threshold corresponding to the feature dimension is constructed: In equation (5): denotes the local perturbation threshold of the i-th dimension of the original input sample denotes the perturbation scaling factor; denotes the residual mean value of the i-th dimension of the original input sample at the last k time instants;​​​​ S2, predicting based on a historical state of the original input sample by using an LSTM model to obtain a predicted value of the original input sample at a current state, and constructing a global perturbation threshold based on a residual between the predicted value of the original input sample at the current state and an actual value thereof, specifically comprising: calculating the residual between the predicted value of the original input sample at the current state and the actual value thereof: In equation (7), represents the original input sample at the current time state prediction value and its actual value residual error between; represents the L2 norm; constructing the global perturbation threshold: ， In equation (8): denotes the interval range of the global perturbation threshold; S3, calculating a perturbation at a current round based on an approximate gradient of the original input sample at the current round by using a target model, constraining the perturbation at the current round by using the local perturbation threshold, and updating an adversarial sample based on the constrained perturbation; S4, performing rationality judgment on a perturbation amplitude of the updated adversarial sample by using the global perturbation threshold, and performing attack effect judgment on the adversarial sample that meets the rationality judgment condition, taking the adversarial sample that meets the attack effect judgment condition as a target adversarial sample and outputting.

2. The power artificial intelligence application black box attack defect analysis method according to claim 1, characterized in that, In S3, the perturbation at the current round is calculated based on the approximate gradient of the original input sample at the current round by using the target model, specifically comprising: obtaining the approximate gradient of the original input sample at the current round by using a finite difference method: In formula (9): represents an output function of the target model, i.e., a target function; represents an original input sample of the target model for the current M-th round the first dimensional approximate gradient; is a standard basis vector, and only the first dimension is 1, and the remaining dimensions are 0; is a constant; integrating the approximated gradients of all dimensions of the original input sample into a vector taking the sign direction and multiplying it by a perturbation step, i.e. obtaining the perturbation for the current round: In equation (10): denotes the current Mth round of perturbation; denotes the perturbation step size; denotes the sign function, which converts positive numbers to 1 and negative numbers to -1.

3. The power artificial intelligence application black box attack defect analysis method according to claim 2, characterized in that, in S3, the perturbation at the current round is constrained by using the local perturbation threshold: In equation (11), denotes the perturbation on the original input sample in the M-th round. dimension. denotes the perturbation on the original input sample restricted within the local perturbation threshold interval . denotes the perturbed original input sample in the M-th round. dimension.

4. The power artificial intelligence application black box attack defect analysis method according to claim 3, characterized in that, in S3, the adversarial sample is updated based on the constrained perturbation: In formula (12): represents the current Mth round of adversarial samples; represents the updated adversarial samples.

5. The power artificial intelligence application black box attack defect analysis method according to claim 4, characterized in that, in S4, the rationality judgment condition is: In equation (13): denotes the updated adversarial sample; denotes the initial adversarial sample; denotes the L2 norm; the attack effect judgment condition is: In equation (14): denotes the target model's prediction on the updated adversarial sample , denotes the model parameters, is the true label of the original input sample , i.e., the target class in the classification task.

6. A device for implementing the power artificial intelligence application black-box adversarial attack defect analysis method according to any one of claims 1 to 5, characterized in that, The device comprises: a local threshold construction module configured to construct a local perturbation threshold for each feature dimension of an original input sample based on time residual analysis, wherein the original input sample is node measurement data comprising a plurality of feature dimensions; a global threshold construction module configured to predict based on a historical state of the original input sample by using an LSTM model to obtain a predicted value of the original input sample at a current state, and construct a global perturbation threshold based on a residual between the predicted value of the original input sample at the current state and an actual value thereof; a sample updating module configured to calculate a perturbation at a current round based on an approximate gradient of the original input sample at the current round by using a target model, constrain the perturbation at the current round by using the local perturbation threshold, and update an adversarial sample based on the constrained perturbation; a result judgment module configured to perform rationality judgment on a perturbation amplitude of the updated adversarial sample by using the global perturbation threshold, and perform attack effect judgment on the adversarial sample that meets the rationality judgment condition, take the adversarial sample that meets the attack effect judgment condition as a target adversarial sample and output.

7. An electronic device, comprising: The electronic device comprises: at least one processor; and A memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the power artificial intelligence application black-box adversarial attack defect analysis method of any one of claims 1 to 5.

8. A machine-readable storage medium, characterized in that, The machine-readable storage medium has stored thereon executable instructions that, when executed, cause the machine to perform the power artificial intelligence application black-box adversarial attack defect analysis method of any one of claims 1 to 5.

Images